The problem with WAF is discussed in https://users.ece.cmu.edu/~adrian/731-sp04/readings/Ptacek-N....
One of the authors of the paper has said "WAFs are just speed bump to a determined attacker."
replies(2):
One of the authors of the paper has said "WAFs are just speed bump to a determined attacker."